fix(ci): collect+upload kernel .deb on failure (linux-image often built before headers fail)

The bindeb-pkg target builds linux-image-*.deb FIRST then attempts the
linux-headers-*.deb. The headers build can fail (silent in CI log) while
linux-image is already on disk and ready to deploy. The deployment-
critical artifact for the MochaBin mesh integration is linux-image —
headers/libc-dev are needed only for out-of-tree module builds against
this kernel (which we don't do today).

Add `if: always()` to both Collect and Upload steps so partial
artifacts survive a late bindeb-pkg failure. Downgrade if-no-files-found
from `error` to `warn` so a fully empty /tmp/artifacts/ doesn't mask
the real upstream failure with a misleading artifact error.

.github/workflows/build-kernel.yml

@@ -154,6 +154,10 @@ jobs:
                bindeb-pkg
 
       - name: Collect .deb artifacts
+        # always() : even if bindeb-pkg fails late (linux-headers/linux-libc-dev
+        # build aborted), the linux-image-*.deb may already be on disk and is
+        # the deployment-critical artifact.
+        if: always()
         run: |
           mkdir -p /tmp/artifacts
           # bindeb-pkg drops .deb files in /tmp/build (one level above the src tree).
@@ -163,9 +167,11 @@ jobs:
           ls -la /tmp/artifacts/
 
       - name: Upload kernel .deb bundle
+        # always() so partial artifacts (linux-image-only) still land.
+        if: always()
         uses: actions/upload-artifact@v4
         with:
           name: secubox-kernel-${{ inputs.kernel_version }}-${{ inputs.revision }}-arm64
           path: /tmp/artifacts/*.deb
-          if-no-files-found: error
+          if-no-files-found: warn
           retention-days: 30